chore(deps): update dependency undici@>=6.0.0 to ^6.23.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
undici@>=6.0.0 (source)	^6.21.2 → ^6.23.0

GitHub Vulnerability Alerts

CVE-2026-22036

Impact

The fetch() API supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., Content-Encoding: gzip, br). This is also supported by the undici decompress interceptor.

However, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation.

Patches

Upgrade to 7.18.2 or 6.23.0.

Workarounds

It is possible to apply an undici interceptor and filter long Content-Encoding sequences manually.

References

• https://hackerone.com/reports/3456148
• GHSA-gm62-xv2j-4w53
• https://curl.se/docs/CVE-2022-32206.html

---

Release Notes

nodejs/undici (undici@>=6.0.0)

v6.23.0

Compare Source

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

Compare Source

What's Changed

• fix: fix wrong stream canceled up after cloning (v6) by @​snyamathi in #​4414
• [Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @​github-actions[bot] in #​4432
• feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#​4180) by @​metcoder95 in #​4433
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#​4180) (#​4340) by @​metcoder95 in #​4445
• Backport 4472 to v6.x by @​Uzlopak in #​4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

Compare Source

What's Changed

• [Backport v6.x] append crlf to formdata body by @​github-actions in #​4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	1533049
🔍 Latest deploy log	https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/697a631f45734b000857fd4e

[github-actions]

🚀 Performance Test Results

Test Configuration:

• VUs: 4
• Duration: 1m0s

Test Metrics:

• Requests/s: 44.81
• Iterations/s: 14.94
• Failed Requests: 0.00% (0 of 2693)

📜 Logs

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test "-k" "-q" "--vus" "4" "--duration" "1m"

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 972 kB 16 kB/s
     data_sent......................: 2.1 MB 34 kB/s
     http_req_blocked...............: avg=6.79µs   min=1.79µs   med=4.8µs    max=1.2ms    p(90)=6.03µs   p(95)=6.54µs  
     http_req_connecting............: avg=176ns    min=0s       med=0s       max=108.54µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=88.63ms  min=6.82ms   med=73.54ms  max=671.5ms  p(90)=149.88ms p(95)=171.81ms
       { expected_response:true }...: avg=88.63ms  min=6.82ms   med=73.54ms  max=671.5ms  p(90)=149.88ms p(95)=171.81ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2693
     http_req_receiving.............: avg=82.24µs  min=26.44µs  med=71.11µs  max=1.99ms   p(90)=106.15µs p(95)=131.68µs
     http_req_sending...............: avg=37.18µs  min=8.1µs    med=26.46µs  max=2.65ms   p(90)=39.17µs  p(95)=55.44µs 
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=88.51ms  min=6.69ms   med=73.46ms  max=671.39ms p(90)=149.78ms p(95)=171.72ms
     http_reqs......................: 2693   44.806689/s
     iteration_duration.............: avg=267.44ms min=169.93ms med=251.94ms max=1.19s    p(90)=329.23ms p(95)=364.47ms
     iterations.....................: 898    14.941109/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4